CVE-2024-1122: fallo de gravedad media en arraytics Eventin – Event Calendar, Event…
Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin <= 3.3.50 - Missing Authorization to Unauthenticated Events Export
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.5%
The Event Manager, Events Calendar, Events Tickets for WooCommerce – Eventin plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the export_data() function in all versions up to, and including, 3.3.50. This makes it possible for unauthenticated attackers to export event data.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Productos afectados
arraytics · Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered)CVEs relacionadas — arraytics Eventin – Event Calendar, Event…
En el mismo producto, de las más peligrosas a las menos.
CVE-2024-7149HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.8 - Authenticated (Contributor+) Local File InclusionEPSS 1.0%CVE-2025-1770HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Authenticated (Contributor+) Local File InclusionEPSS 0.9%CVE-2025-3419HIGHEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.26 - Unauthenticated Arbitrary File ReadEPSS 0.7%CVE-2025-4796HIGHEventin <= 4.0.34 - Authenticated (Contributor+) Privilege Escalation via User Email Change/Account TakeoverEPSS 0.7%CVE-2025-1766MEDIUMEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.24 - Missing Authorization to Unauthenticated Payment Status UpdateEPSS 0.4%CVE-2024-6033MEDIUMEvent Manager, Events Calendar, Tickets, Registrations – Eventin <= 4.0.4 - Missing Authorization to Authenticated (Contributor+) Event Data ImportEPSS 0.4%